> -----Original Message-----
> From: Kitszel, Przemyslaw <[email protected]>
> Sent: Tuesday, July 7, 2026 12:44 AM
> To: [email protected]; Schmidt, Michal
> <[email protected]>; Jakub Kicinski <[email protected]>
> Cc: [email protected]; Nguyen, Anthony L
> <[email protected]>; Loktionov, Aleksandr
> <[email protected]>; Andrew Lunn <[email protected]>;
> David S. Miller <[email protected]>; Eric Dumazet
> <[email protected]>; Paolo Abeni <[email protected]>; Jagielski,
> Jedrzej <[email protected]>; Kwapulinski, Piotr
> <[email protected]>; Kitszel, Przemyslaw
> <[email protected]>; Marcin Szycik
> <[email protected]>
> Subject: [PATCH iwl-net v2 2/2] ice: fix stats array overflow via
> proper realloc
>
> Integrate ice_vsi_alloc_stat_arrays() with realloc variant.
>
> Instead of keeping two functions for stat arrays allocation, change
> the
> ice_vsi_realloc_stat_arrays() to handle initial condition (no vsi_stat
> entry) and replace ice_vsi_alloc_stat_arrays() by the more generic
> ice_vsi_realloc_stat_arrays().
>
> Note that VSIs of ICE_VSI_CHNL type are ignored in realloc variant as
> they were in the replaced ice_vsi_alloc_stat_arrays().
>
> This is a fix for stats array overflow that occurs when VF is given
> more queues (an operation that will be more frequent, and by bigger
> increase, when we will merge my "XLVF" series).
>
> Splat for increasing number of queues thanks to Michal Schmidt:
> KASAN detects the bug:
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in
> ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice] Read of size 8 at addr
> ffff88810affea60 by task kworker/u131:7/221
>
> CPU: 24 UID: 0 PID: 221 Comm: kworker/u131:7 Not tainted 7.1.0-rc1+
> #1 PREEMPT(lazy) ...
> Workqueue: ice ice_service_task [ice]
> Call Trace:
> <TASK>
> ...
> kasan_report+0xd7/0x120
> ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice]
> ice_vsi_cfg_def+0x12e2/0x2060 [ice]
> ice_vsi_cfg+0xb5/0x3c0 [ice]
> ice_reset_vf+0x858/0xf80 [ice]
> ice_vc_request_qs_msg+0x1da/0x290 [ice]
> ice_vc_process_vf_msg+0xb15/0x1430 [ice]
> __ice_clean_ctrlq+0x70d/0x9d0 [ice]
> ice_service_task+0x840/0xf20 [ice]
> process_one_work+0x690/0xff0
> worker_thread+0x4d9/0xd20
> kthread+0x322/0x410
> ret_from_fork+0x332/0x660
> ret_from_fork_asm+0x1a/0x30
> </TASK>
>
> Allocated by task 2439:
> kasan_save_stack+0x1c/0x40
> kasan_save_track+0x10/0x30
> __kasan_kmalloc+0x96/0xb0
> __kmalloc_noprof+0x1d8/0x580
> ice_vsi_cfg_def+0x115c/0x2060 [ice]
> ice_vsi_cfg+0xb5/0x3c0 [ice]
> ice_vsi_setup+0x180/0x320 [ice]
> ice_start_vfs+0x1f3/0x590 [ice]
> ice_ena_vfs+0x66d/0x798 [ice]
> ice_sriov_configure.cold+0xe4/0x121 [ice]
> sriov_numvfs_store+0x279/0x480
> kernfs_fop_write_iter+0x331/0x4f0
> vfs_write+0x4c4/0xe40
> ksys_write+0x10c/0x240
> do_syscall_64+0xd9/0x650
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> The buggy address belongs to the object at ffff88810affea40
> which belongs to the cache kmalloc-32 of size 32 The
> buggy address is located 0 bytes to the right of
> allocated 32-byte region [ffff88810affea40,
> ffff88810affea60)
>
> Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with
> ice_vf_reconfig_vsi()")
> Closes: https://redhat.atlassian.net/browse/RHEL-164321
> Reviewed-by: Marcin Szycik <[email protected]>
> Signed-off-by: Przemek Kitszel <[email protected]>
> ---
> This is an alternative to the fix [1] by Michal Schmidt, which were
> blocked due to AI feedback. My fix was already developed before
> Michal's, just not public back then. We have agreed to go on with my
> version.
>
> [1] https://lore.kernel.org/netdev/20260520183501.3360810-3-
> [email protected]
>
> v1:
> https://lore.kernel.org/intel-wired-lan/20260701104141.9740-2-
> [email protected]
>
> v2: Sashiko:
> * defer pf->vsi_stats[vsi->idx] to be done only after successful Tx
> and Rx stats arrays
> allocation - this avoids "half initialized" state processing in
> ice_vsi_free_stats().
> The above was reported by both opus-4.6 and gemini-3.1-pro. All
> other errors reported by
> just gemini were a mix between false-positives and too-
> cornercase'y. Gemini report for v1:
> https://sashiko.dev/#/patchset/20260701104141.9740-1-
> przemyslaw.kitszel%40intel.com
> * store also array lengths in separate variable for better tracking
> and proper freeing.
> ---
> drivers/net/ethernet/intel/ice/ice.h | 2 +
> drivers/net/ethernet/intel/ice/ice_lib.c | 80 ++++++++---------------
> -
> 2 files changed, 29 insertions(+), 53 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice.h
> b/drivers/net/ethernet/intel/ice/ice.h
> index f72bb1aa4067..b63b59f2d203 100644
> --- a/drivers/net/ethernet/intel/ice/ice.h
> +++ b/drivers/net/ethernet/intel/ice/ice.h
> @@ -328,6 +328,8 @@ enum ice_vsi_state { struct ice_vsi_stats {
> struct ice_ring_stats **tx_ring_stats; /* Tx ring stats array
> */
> struct ice_ring_stats **rx_ring_stats; /* Rx ring stats array
> */
...
> if (ret)
> goto unroll_vsi_alloc;
>
> --
> 2.54.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
